In order to ensure reentering spacecraft do not pose an undue risk to the Earth's population it is important to design satellites and rocket bodies with end of life considerations in mind. In addition to considering the possible consequences of deorbiting a vehicle, consideration must also be given to the possible risks associated with a vehicle failing to become operational or reach its intended orbit. Based on recovered space debris and numerous reentry survivability analyses, fuel tanks are of particular concern in both of these considerations. Most spacecraft utilize some type of fuel tank as part of their propulsion system. These fuel tanks are most often constructed using stainless steel or titanium and are filled with potentially hazardous substances such as hydrazine and nitrogen tetroxide. For a vehicle which has reached its scheduled end of mission the contents of the tanks are typically depleted. In this scenario the use of stainless steel and titanium results in the tanks posing a risk to people and property do to the high melting point and large heat of ablation of these materials leading to likely survival of the tank during reentry. If a large portion of the fuel is not depleted prior to reentry, there is the added risk of hazardous substance being released when the tank impact the ground. This paper presents a discussion of proactive methods which have been utilized by NASA satellite projects to address the risks associated with fuel tanks reentering the atmosphere. In particular it will address the design of a demiseable fuel tank as well as the evaluation of off the shelf designs which are selected to burst during reentry

Johnson, Nicholas L.

Kelley, Robert L.

NASA Technical Reports Server

EVALUATING AND ADDRESSING POTENTIAL HAZRDS OF FUEL TANKS 
SURVIVING ATMOSPHERIC REENTRY 
 
R.L. Kelley(1), N.L. Johnson(2) 
 
(1)ESCG/Jacobs Technology, Mail Code JE104, 2224 Bay Area Blvd., Houston, TX 77058, USA, 
Robert.L.Kelley@nasa.gov 
 (2)Orbital Debris Program Office, NASA Johnson Space Center, Houston, TX 77058, USA, 
Nicholas.L.Johnson@nasa.gov 
 
 
Abstract 
 In order to ensure reentering spacecraft do not pose an undue risk to the Earth’s population it is important 
to design satellites and rocket bodies with end of life considerations in mind.  In addition to considering the possible 
consequences of deorbiting a vehicle, consideration must also be given to the possible risks associated with a vehicle 
failing to become operational or reach its intended orbit.  Based on recovered space debris and numerous reentry 
survivability analyses, fuel tanks are of particular concern in both of these considerations. 
 Most spacecraft utilize some type of fuel tank as part of their propulsion system.  These fuel tanks are most 
often constructed using stainless steel or titanium and are filled with potentially hazardous substances such as 
hydrazine and nitrogen tetroxide.  For a vehicle which has reached its scheduled end of mission the contents of the 
tanks are typically depleted.  In this scenario the use of stainless steel and titanium results in the tanks posing a risk 
to people and property do to the high melting point and large heat of ablation of these materials leading to likely 
survival of the tank during reentry.  If a large portion of the fuel is not depleted prior to reentry, there is the added 
risk of hazardous substance being released when the tank impact the ground. 
 This paper presents a discussion of proactive methods which have been utilized by NASA satellite projects 
to address the risks associated with fuel tanks reentering the atmosphere.  In particular it will address the design of a 
demiseable fuel tank as well as the evaluation of “off the shelf” designs which are selected to burst during reentry.   
  
 
https://ntrs.nasa.gov/search.jsp?R=20110008637 2019-08-30T15:13:22+00:00Z
EVALUATING AND ADDRESSING POTENTIAL HAZARDS OF FUEL TANKS 
SURVIVING ATMOSPHERIC REENTRY 
 
R.L. Kelley
(1)
, N.L. Johnson
(2) 
 
(1)
ESCG/Jacobs Technology, Mail Code JE104, 2224 Bay Area Blvd., Houston, TX 77058, USA, 
Robert.L.Kelley@nasa.gov 
(2) 
Orbital Debris Program Office, NASA Johnson Space Center, Houston, TX 77058, USA, 
Nicholas.L.Johnson@nasa.gov 
 
 
ABSTRACT 
 
In order to ensure reentering spacecraft do not pose an 
undue risk to the Earth’s population, it is important to 
design satellites and rocket bodies with end-of-life 
considerations in mind. In addition to the possible 
consequences of deorbiting a vehicle, consideration 
must be given to the possible risks associated with a 
vehicle failing to become operational or to reach its 
intended orbit.  Based on recovered space debris and 
numerous reentry survivability analyses, fuel tanks are 
of particular concern in both of these considerations.  
Most spacecraft utilize some type of fuel tank as part of 
their propulsion systems.  These fuel tanks are most 
often constructed using stainless steel or titanium and 
are filled with potentially hazardous substances such as 
hydrazine and nitrogen tetroxide.  For a vehicle that 
has reached its scheduled end-of mission, the contents 
of the tanks are typically depleted. In this scenario, the 
likely survival of a stainless steel or titanium tank 
during reentry poses a risk to people and property due 
to the high melting point and large heat-of-ablation of 
these materials.  If a large portion of the fuel is not 
depleted prior to reentry, there is the added risk of a 
hazardous substance being released when the tank 
impacts the ground.   
 
This paper presents a discussion of proactive methods 
that have been utilized by NASA satellite projects to 
address the risks associated with fuel tanks reentering 
the atmosphere.  In particular, it will address the design 
of a demiseable fuel tank, as well as the evaluation of 
fuel tank designs, which are selected based on whether 
they burst during reentry. 
 
1. INTRODUCTION 
 
The propulsion systems of spacecraft represent a 
unique and challenging problem when considering 
risks to the Earth’s population.  The tanks themselves, 
such as the Delta 2 second stage tank in Fig. 1, are 
usually constructed of titanium or stainless steel and 
often survive reentry, resulting in a possible impact 
risk to people and property on the ground.  In addition 
the types of fuels used in many of these vehicles are 
often hazardous, resulting in possible environmental 
risks should a spacecraft reenter with significant 
amounts of fuel on board, as can be seen in Fig. 2.  
Giving consideration to the risks associated with all 
parts of a vehicle’s life cycle are necessary, whether it 
be to the vehicle which reenters after it has depleted its 
fuel supply or the vehicle which fails to reach its 
desired orbit and reenters with a significant amount of 
fuel on board.  It becomes necessary to evaluate 
numerous malfunction scenarios associated with these 
tanks, not only for Earth orbiting vehicles, but also for 
interplanetary spacecraft.   
  
 
 
Figure 1. A 250 kg., stainless steel Delta 2 second 
stage reentered and landed in Texas in 1997. 
 
Spacecraft designers across NASA have begun to 
proactively address these issues.  For Earth orbiting 
spacecraft, the Design for Demise (D4D) program has 
seen NASA Goddard Spaceflight Center (GSFC) 
working with the NASA Johnson Space Center (JSC) 
to evaluate the spacecraft bus, payload instruments, 
and structural components for their potential to survive 
reentry.  For interplanetary spacecraft experiencing 
mission failure, NASA Jet Propulsion Laboratory 
(JPL) has worked to limit the environmental impact of 
loaded fuel tanks by seeking out tank designs that are 
likely to burst during reentry  Both of these efforts 
require an iterative process between the spacecraft 
designers and the JSC Object Reentry Survival 
Analysis Tool (ORSAT) team. 
 
 
Figure 2. A Haz Mat team recovers a fuel tank from the 
2003 break-up of the Space Shuttle Columbia. 
 
2. THE IMPACT RISK 
 
The use of materials with a high likelihood of 
surviving reentry in fuel tanks stretches back to the 
early years of launching objects into space.  The actual 
number of tanks that impact the ground is difficult to 
gauge, since reentry debris that fall on land are rarely 
identified as space debris.  According to data on 
recovered debris dating back to 1960, nearly half of all 
debris recovery events have included at least one object 
described as a metal sphere or a pressure vessel.  These 
tanks are potentially a lethal hazard to the Earth 
population and are found in the construction of both 
satellites and launch vehicles.  The recognition of this 
hazard is why fuel tanks are one of the primary 
components addressed in D4D strategies. 
 
In an attempt to address the survivability of the 
Gamma-ray Large Area Space Telescope (GLAST) 
fuel tank, GSFC began addressing reentry survivability 
risks late in the design process.    Due to the size of the 
vehicle, a propulsion system was included in the 
baseline design to permit a controlled reentry at end of 
life [1].  If looking at only those items which have a 
kinetic energy (KE) >15 J, the propulsion system 
accounted for more than half of the predicted surviving 
debris.  Removing the propulsion system, thereby 
removing the risk associated with the fuel tank, 
coupled with a few other minor design changes, would 
have resulted in the vehicle being considered compliant 
for an uncontrolled reentry.   
 
For the Global Precipitation Mission (GPM), a joint 
NASA and Japanese Aerospace Exploration Agency 
project to follow the Tropical Rainfall Measurement 
Mission (TRMM), designers at GSFC took a novel 
approach to the design of their vehicle.  Much like a 
typical mission establishes mass and power budgets for 
the various components of its vehicle, the GPM team 
established a debris casualty area (DCA) budget for the 
various subsystems of the vehicle.  Since propulsion 
subsystems are typically a large source of DCA, it was 
necessary to study the available options for fuel tanks.  
This led to an extensive collaboration between the 
GSFC GPM design team and the JSC ORSAT team, 
beginning in mid 2002, with an extensive study of fuel 
tank survivability.   
 
The GPM was in the early stages of its design, so the 
initial phase of the study evaluated generic spacecraft, 
based on rough estimates of the planned GPM design 
utilizing a spherical fuel tank.  The purpose of this 
phase of the study was to determine materials that 
would likely demise during reentry, while also looking 
at varying wall thicknesses to set a baseline for the tank 
selection.  As expected, the tanks containing stainless 
steel or titanium were predicted to  survive.  Those 
made of aluminum could be made to demise if the 
proper wall thicknesses were used.  While there had 
been previous instances of aluminum being used to 
construct hydrazine tanks, it had been limited to 
vehicles, such as rocket bodies, where the mission 
lifetime was short.  The GPM mission called for a 25-
year lifetime, leading to concerns regarding the 
compatibility of aluminum and hydrazine for such a 
long time. 
 
Since GPM was designed to be similar to the TRMM, 
it was decided to use the TRMM’s geometry and 
trajectory initial condition as a baseline for further 
analysis.  This follow-up set of analyses varied the size 
(0.46 m
3
 or 0.92 m
3
), shape (cylinder or sphere), 
material composition (monolithic or composite), and 
the break-up point of the vehicle when the tank was 
exposed to heating.  The results from this study 
indicated that the most demiseable tank would be an 
aluminum shell with a composite overwrap and an 
internal aluminum propellant management device [2].  
While  the ORSAT team studied the survivability of 
the tanks, GSFC undertook a series of materials 
evaluation tests to address the concerns regarding the 
long term exposure of aluminum to hydrazine. While 
the final design for GPM required it to undertake a 
controlled reentry, the fully demiseable fuel tank, 
which resulted from these efforts, is a component that 
is potentially useful to generations of future spacecraft. 
 
3. THE ENVIRONMENTAL RISK 
 
The potential uncontrolled reentry of the disabled 
USA-193 spacecraft in 2008 was one of the most 
widely recognized reentry risks since 2001.  The 
titanium fuel tank at the heart of the vehicle (Fig. 3), 
containing approximately 450 kg of frozen hydrazine, 
was predicted by multiple, independent, detailed 
analyses to have the potential to survive reentry intact 
(as is the typical result for empty tanks), allowing its 
contents to vaporize and pose a hazard to people on 
Earth.  While the immediate risk for this tank was the 
impacting body, a concern arose for the environmental 
damage around the impact site and the potential for an 
additional health hazard to people.  Had this tank been 
made of a material with a lower melting temperature, 
the decision to destroy it prior to reentry would have 
been unnecessary.  As a result of this event, the 
consideration of the possible environmental impacts 
related to reentering fuel tanks was recognized as being 
important.   
 
 
 
Figure 3. Titanium fuel tank design used for the USA-
193 spacecraft. 
 
Leading the way in NASA’s effort to reduce 
environmental risks were project teams from JPL who 
were working on the development of the Juno and 
Mars Science Laboratory (MSL) spacecraft.  Both of 
these missions are interplanetary, and, thus, not 
normally pertinent to end-of-life reentry risk issues.  
Instead, the focus for these vehicles was on what would 
happen if the spacecraft failed to leave Earth orbit.  
The result of this scenario would be vehicles with large 
amounts of fuel that would eventually reenter the 
atmosphere, a situation that is not usually considered 
during the design phase.  This consideration led to a 
number of studies by the JSC ORSAT team, based on 
numerous satellite tank designs, with the goal to 
determine whether it was likely that fuel from these 
tanks would reach the ground should the vehicle 
reenter Earth’s atmosphere. Tab. 1 shows the results of 
analyses to determine if the fuel tanks were likely to 
burst during reentry, as well as the DCA for the empty 
tanks. 
 
Table 1. Results of tank bursting study 
 
 122 km Initial Altitude 
 
Burst 
Altitude 
(km) with 
fuel and 
pressure 
Altitude 
Burst 
(km) 
with fuel 
Empty 
Tank 
Debris 
Casualty 
Area (m2) 
MSL Descent 61.1 60.9 1.4 
MSL Cruise 74.2 73.8 1.1 
Juno 56.7 56.3 2.0 
MRO 51.3 44.2 3.4 
CGRO 57.0 47.4 2.3 
Cassini 71.7 64.1 1.5 
    
 78 km Initial Altitude 
 
Altitude 
Burst 
(km) with 
fuel and 
pressure 
Altitude 
Burst 
(km) 
with fuel 
Empty 
Tank 
Debris 
Casualty 
Area (m2) 
MSL Descent 60.9 60.9 1.4 
MSL Cruise 72.5 72.3 1.1 
Juno 55.0 54.5 2.0 
MRO 46.5 37.2 3.4 
CGRO 54.5 43.4 2.3 
Cassini 70.3 63.7 1.5 
 
The initial studies concluded that if the tanks broke 
apart from the vehicle in such a way that the fuel and 
pressurant contained inside were unable to vent, then 
the tanks would burst, causing the contents to disperse 
into the atmosphere.  The team at JPL took this one 
step further and looked at ways to predict the amount 
of fuel left in the tank should the lines be open or only 
partially blocked.  The result of this further analysis is 
that, had Juno not successfully left Earth orbit, there 
was a risk that its fuel tanks would have impacted the 
ground containing approximately 38 kg of liquid 
hydrazine.  For MSL the picture is more benign, in 
that, should it fail to leave Earth orbit, the tank is not 
likely to have any residual fuel left in its tank when it 
impacts the ground [3].  In both of these cases, the 
analysis took place late in the design phase and was 
done mainly to understand the existing risk associated 
with those vehicles. 
 For the EXO Mars 2016 vehicle, consideration of 
possible tank survival took place earlier in the design 
phase and is ongoing.  For this vehicle, the JPL team 
presented a description of the preliminary tank design 
to the JSC ORSAT team prior to the design being 
finalized.  This mission utilizes a bi-propellant system, 
which results in the vehicle having a mono-methyl 
hydrazine tank, as well as a nitrogen tetroxide tank.  As 
in the earlier study, analysis was performed to 
determine if the tanks were likely to burst should they 
break away from the vehicle in a manner that prevents 
the fuel from escaping.  The analysis on these tanks 
also took into account the possibility of the attitude of 
the tanks being stable.  Preliminary results indicate that 
the tanks are likely to burst if there is no way for the 
fuel to escape, or the tank wall is likely to be breached, 
should the attitude remain stable.   
 
4. CONCLUSIONS 
 
The use of high-melting temperature materials in the 
manufacture of fuel tanks leads to two different types 
of hazardous situations should these tanks reach the 
ground.  The sheer size and mass of these tanks results 
in them being a potential hazard should they impact 
someone or something on the Earth’s surface.  The 
possibility that these tanks could contain large 
quantities of fuel when they impact creates an 
additional hazard to the environment in the immediate 
vicinity of the impact location.   
 
Efforts to minimize these risks require careful 
consideration early in the vehicle’s design phase.  Had 
the GLAST project team followed the current safety 
standards they could have ignored the risk associated 
with objects that impacted with a low KE.  This would 
have permitted them to completely remove the 
propulsion system, thereby eliminating the associated 
impact risk.  GPM was able to completely remove the 
risk by designing a tank in such a way that it fully 
demised.  In order to reduce the environmental risk 
associated with fuel tanks, JPL is proactively working 
on the design of fuel tanks for interplanetary spacecraft 
to ensure that little to no fuel impacts the ground 
should the vehicle unexpectedly reenter. 
 
By implementing a D4D strategy from the onset of a 
mission, the cost of compliance with safety standards 
can be minimized, especially when it comes to 
propulsion systems.  In the case of GLAST, this would 
have resulted in the elimination of an entire subsystem, 
permitting more mass for payloads.  For future 
vehicles, consideration of all aspects of the vehicle’s 
lifetime could result in a decision that will lead to an 
environment on Earth that is not at risk due to the 
potential reentry of objects launched into space. 
 
5. REFERENCES 
 
1. Leibee, J. Ford, T. & Whipple, A. (2004).  NASA 
GLAST Project Experiences Managing Risks of 
Orbital Debris.  In 8
th
 International Conference 
on Space Operation 
 
2. Estes, R.H. & Moore, N.R. (2004). An Overview of 
Demise Calculations, Conceptual Design 
Studies, and Hydrazine Compatibility Testing 
for the GPM Core Spacecraft Propellant Tank 
 
3. Li, H (2010). Orbital Reentry Survivability of 
Liquid Hydrazine in MSL Descent Stage 
Hydrazine Tank at Ground Impact. JPL IOM 
No. 352L-HL-1002 


Evaluating and Addressing Potential Hazards of Fuel Tanks Surviving Atmospheric Reentry

Abstract

Similar works

Full text

Available Versions

NASA Technical Reports Server